fix(dynamic-agents): pin validated fetch addresses

[sriaradhyula]

Description

Keep fetch connections aligned with the address approved during URL validation.

• Resolve and validate all addresses once per request hop.
• Connect to the selected validated address.
• Preserve the original Host header, TLS server name, and certificate hostname check.
• Disable environment-proxy inheritance for these direct requests.
• Re-resolve, revalidate, and repin each redirect hop.

Type of Change

• Bugfix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (please describe)

Pre-release Helm Charts (Optional)

No chart changes.

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable)
• I have verified this change is not present in other open pull requests

Validation

• 18 focused tests passed, including a real pinned local socket request
• Redirect repinning, Host preservation, IPv6 formatting, and no-fallback behavior covered
• Ruff passed

[github-actions]

✅ No proprietary content detected. This PR is clear for review!

[github-actions]

ℹ️ Branch is behind main (advisory, non-blocking)

Commit: 8118ccc1

This branch does not yet contain the latest main. This does not fail the version-bump check — version files are bumped once the branch is updated, and GitHub branch protection still requires the branch to be up to date before merge. Use the Update branch button on this PR, or run:

git fetch origin main
git checkout prebuild/fix/fetch-url-dns-pinning
git merge FETCH_HEAD
git push

This is a prebuild/* branch, so Helm prebuild publishing will still run so you can test the chart changes while the branch is being updated.